Segmentation Fault Vulnerability in GNU Patch Package - CVE-2018-6951
Summary
ALPINE-CVE-2018-6951: An issue was discovered in GNU patch through 2.7.6. Affects patch versions < 2.7.6-r2. Fixed in 2.7.6-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Patch is a widely used utility that allows users to apply changes to files and manage patches. It is essential for software development and maintenance, enabling developers to update source code efficiently. However, certain versions of GNU Patch are vulnerable to a segmentation fault due to a NULL pointer dereference, which can lead to denial of service.
Vulnerability Detail
An issue was discovered in GNU Patch through version 2.7.6. The vulnerability arises from a segmentation fault in the intuit_diff_type function located in pch.c, which is triggered by a NULL pointer dereference. This flaw can cause the application to crash, leading to a denial of service. The vulnerability is classified under CVE-2018-6951, with a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.7.6-r2
This is the first release that contains the fix.
sudo apk add --upgrade patchTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider avoiding the use of the affected function or limiting the input to prevent triggering the vulnerability. However, the best course of action is to apply the patch as soon as possible.
Conclusion
The CVE-2018-6951 vulnerability in GNU Patch poses a significant risk due to its potential to cause denial of service through a segmentation fault. It is crucial for users to update to the patched version to mitigate this risk effectively.
See every vulnerability recorded for patch →
FAQ
CVE-2018-6951 is a vulnerability in GNU Patch that can cause a segmentation fault due to a NULL pointer dereference, leading to denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2018-6951 is 7.5, indicating a high severity level.
If you cannot update the package immediately, avoid using the affected function or limit the input to prevent triggering the vulnerability.
You can find more information about GNU Patch and its functionalities on the official GNU website or its documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for patch.
